Privacy policy

Last updated 11 October 2026

Courtesy translation. Only the Romanian text is binding: read the original

Version PRIV-1.4 · 11 October 2026

This policy describes the personal data that OPTISWIFT S.R.L. processes through the website www.optiswift.ro, through trial accounts and through subscriptions to the OptiSwift software: what the data are, where it obtains them, why and on what legal basis it processes them, to whom it discloses them, how long it keeps them and what rights you have. It contains the information required by Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).

0 · What this policy covers

0.1 · Terms used

“the Provider” or “we”: OPTISWIFT S.R.L., identified in § 1.
“the Practice”: the business — an optical or optometry practice — that uses the Software under a subscription or a trial account.
“the Software”: the OptiSwift desktop application for Windows and macOS.
“the Service”: the online infrastructure through which the Software operates: the database, authentication, file storage and server functions.
“the Site”: www.optiswift.ro, including the account portal at www.optiswift.ro/cont.
“the Data Processing Agreement”: the agreement on the processing of personal data concluded between the Practice and the Provider under Article 28 GDPR, together with its annexes, published at www.optiswift.ro/abonament/contract-imputernicire.
“EEA”: the European Economic Area.

0.2 · The data for which we are the controller

We determine the purposes and means of the processing, and are therefore the controller, for the data of people who:

read the Site or write to us;
request a trial account;
act for a client Practice: the holder of the licence account, the person who activates the subscription and accepts the contracts, including the Referral Programme Rules, and the billing contact;
send us issue reports from the Software as members of a Practice’s staff, or work on computers from which the Software sends us error reports.

0.3 · Data in the Software: we process them only for the Practice

For the data that a Practice keeps in the Software — patient data (identity, contact details, examinations, refractions, prescriptions, orders, appointments, documents, images, messages), data on the Practice’s staff (user accounts, permissions, audit log) and data on the other people in its records — the controller is the Practice. We are the Practice’s processor: we process these data only on its instructions, under the terms of the Data Processing Agreement, through the sub-processors on the list published at www.optiswift.ro/abonament/subimputerniciti.

We do not use these data for our own purposes: we do not analyse them for ourselves, sell them, use them to train or fine-tune artificial intelligence models, or build patient profiles. The only exception concerns the businesses that a Practice keeps in the Software, not its patients or staff: in the referral programme, with the consent of both Practices given through the Rules, we compare the CUI (Romanian company tax ID) of the referred business with the businesses in their accounts (§ 3.1). SMS and WhatsApp messages to patients are sent through the messaging provider chosen and paid for by the Practice, under the contract between the Practice and that provider.

The Practice decides how long it keeps the data in the Software. After the subscription ends, the Practice has 30 days to export its data; after that period we delete them within 30 days at most, and the backups that still contain them expire within 7 days of the deletion at most (§ 10.3). The archive of the full export that we deliver at the Practice’s request is deleted from our Proton Drive space and from the encrypted volume on which it was prepared once the Practice confirms that it has opened it, and from Proton Drive no later than the expiry of the download link.

If you are a patient of a Practice, the information about your data and the response to your requests come from the Practice, so please contact it. If you write to us, we forward your request to the Practice without delay and do not answer in its place, as the Data Processing Agreement requires.

Section 8 also concerns patients: it explains where the text typed into the Software’s assistant box ends up, since anything may be typed there by mistake.

1 · Who the controller is

OPTISWIFT S.R.L., a limited liability company with its registered office in București, Sectorul 3, Str. Nerva Traian nr. 27-33, Scara B, Etaj 1, Birou 6, registered in the Trade Register under no. J2026055914008 (EUID ROONRC.J2026055914008), CUI 55636472, with subscribed and paid-up share capital of 500 lei.

For any question or request about personal data: contact@optiswift.ro.
Post: to the registered office, at the address above.
Website: www.optiswift.ro.

We do not have a public telephone number. We have not appointed a data protection officer; the reason is explained in § 9.

2 · What data we process and where we obtain them

2.1 · When you read the Site

Hosting logs. The platform that hosts the Site, Vercel, records, like any web server, the IP address, the date and time, the page requested and the technical details of the request, such as the browser type.
No analytics. The Site does not use analytics or visitor-measurement services.
Cookies and browser storage. When you only read the Site, no cookie is set. The account portal uses strictly necessary session cookies: one that keeps you signed in and, if you request a new password, a few that tie the link you receive by email to the browser from which you requested it. The trial form and the pages opened from its emails keep in tab storage (sessionStorage), for as long as the tab is open, the values needed by the step you are on; once you have signed in, the account portal stores a value there that contains no data about you, which the Site’s bar uses to show “My account”. The Site does not use the browser’s local storage (localStorage). The full list, with the purpose and duration of each value, is in the Cookie and Browser Storage Policy at www.optiswift.ro/cookie-uri.
Downloads of the Software and its updates come from GitHub’s servers, and the Windows installer may download the WebView2 component from Microsoft. Your computer connects directly to these servers, so GitHub and Microsoft receive its IP address, which they process under their own policies.

2.2 · When you write to us

The Site’s contact form sends us by email the subject you chose, your name, your email address, your company’s name if you enter it, and your message. The Site does not keep them: it sends them through Resend (§ 5.1) to our mailbox.
Messages sent to contact@optiswift.ro arrive in the same mailbox, with everything they contain.

Please do not send us patient data by email. If a message does contain such data, we use them only to resolve the request, on behalf of the Practice, and delete them from the mailbox once the request has been resolved.

2.3 · When you request a trial account

The trial form asks for the business’s details — CUI, name, county and town — and your contact details: name, email address and telephone number. You enter the CUI yourself; we fill in the business’s other details from the public taxpayer register kept by ANAF (Romania’s tax authority), through its VAT-payer verification web service, and you can correct them before submitting. For this purpose, the CUI is sent to ANAF through our server as you type it. ANAF receives only the CUI and the current date; the response is reused on the server for 10 minutes at most.
IP address hash. When the form is submitted, we compute a cryptographic hash of the IP address, from which the address cannot be reconstructed, and use it only to limit sign-ups to three per hour from the same address. The IP address itself is not kept.
Email address hash, from which the address cannot be read back, lets us apply the rule “one trial account per business and per email address”.
Trial account emails. We send you an email to confirm your address, with a link valid for 48 hours, and then the link with which you choose your password, which is valid for 72 hours and can be used only once. We keep the codes in the links only as hashes.
The password is chosen by you and kept only as an irreversible hash, in the authentication service. We do not see it and cannot read it.
The trial account lasts 7 days. It contains demo data made up by us, except for the business’s name, its CUI and your name, which appears in the list of accounts, and whatever you enter into it during the trial. The trial account terms, published at www.optiswift.ro/termeni, prohibit entering real patient data.
Internal notice of a new trial. When the trial account opens, we receive an email with the business’s name, CUI, town and county, your name, telephone number and email address, and the start and end dates of the trial, so that we can contact you about a subscription.

2.4 · The licence account and the account portal

The Practice’s licence account: the account’s email address, its password, kept only as a hash, the account name and the time of the last sign-in. It is used to sign in to the Software on the Practice’s computers and to the account portal on the Site.
The account portal runs on the Site’s servers: the email address and password entered at sign-in pass through the Site’s server to the authentication service without being stored on the Site.
Changing the licence account’s email address: the old address, the new address and the times of the request, of the confirmation or of the cancellation. The new address receives a confirmation link valid for 24 hours, kept only as a hash, and the old address receives a notification.
Subscription notices — confirmation of activation, an overdue payment, restriction of access for non-payment, the end of the subscription, the approaching end of the export period and the other notices provided for in the subscription terms — are sent to the licence account’s address and to the billing address.
The Service’s technical logs. For trial and licence accounts, as for the Software, the Service records in the logs of the Supabase platform the IP address, the time and the type of each request, including sign-ins. The authentication service also keeps, for each open session, the IP address and the client identifier (user agent).

2.5 · Activating the subscription and proof of acceptance of the contracts

When the subscription is activated, from the Software or from the Site, we record:

the activation data: the CUI, the business name, the Trade Register number, the address (street, town, county, postcode) and whether the business is VAT-registered, filled in from the ANAF register, the name of the first location, the chosen plan and number of locations, the name and position of the person activating, the billing email address and the Stripe payment identifiers;
proof of acceptance, for each document accepted: its version and cryptographic hash, the date and time of acceptance, the name and position declared by the person accepting, the email address of the account used to accept and that account’s internal identifier, the IP address — the address itself, not a hash as in § 2.3 — and the identifier of the browser or of the Software (user agent) seen by our server; for an acceptance on the Site, also the IP address and browser identifier passed to us by the Site’s server;
the full text of each version of the documents accepted.

2.6 · Billing and payments

The Practice’s billing details: business name, CUI, Trade Register number, address, country, billing email address and whether the business is VAT-registered. Every change to them is recorded in the Practice’s audit log, with the values before and after.
The subscription: the plan (monthly or annual), the locations paid for, the current period, the date of cancellation or termination, the due date of an overdue payment, the dates on which the consequences of non-payment apply and the customer, subscription and invoice identifiers issued by Stripe.
Payments: for the subscription’s Stripe payment documents — payment receipts and payment pages, including those titled “Invoice”, which are not fiscal invoices — their number, amounts, dates, status and page address; for each payment, the billing details at the time of payment, with its lines and amounts, kept for issuing the fiscal invoice; once that is issued, also the fiscal invoice’s series and number, the exchange rate and the total in lei.
The payment method, in brief. You enter the full card number and its security code directly on Stripe’s pages, and they never reach us. From the Software, Stripe’s pages open in a separate window in which the Software runs none of its own code and from which it receives nothing you type; from the Site, they open directly at Stripe. For a card, including one used through Apple Pay or Google Pay, Stripe gives us only its brand (for example, Visa or Mastercard), the last four digits and the month and year of expiry, so that we can show them to you in the Software; for Link and Revolut Pay it gives us only the type of method.
Continuing a payment in the browser. When a payment with Apple Pay or Google Pay has to be continued in the browser, the Software opens an address of the form www.optiswift.ro/plata/…, with a single-use code that is valid for 5 minutes and kept by us only as a hash.
Payment disputes. If a payment is disputed with the bank, we record the fact and the time of the dispute.

2.7 · Support

Issue reports from the Software. Anyone with an account in a Practice with a subscription can send us an issue report from Settings → Issues and suggestions. We receive the type of report, its subject and text, the email address for the reply if one is given, and, added automatically, the Practice’s name, the name, role and internal identifier of the sender, the location, the Software version, the computer’s technical details (user agent) and the time of sending. The report reaches us by email. Attached screenshots do not go through email: they are kept in a private store of the Service, in Ireland, that only we can open, and the email shows only where they are and the file names. The Software asks users not to write patient data in a report, but a screenshot shows everything that was on the screen. We process patient data that appear in a report or a screenshot only on behalf of the Practice, as processor (§ 0.3), and only to resolve the report.
Remote assistance. On Windows, the “Start remote assistance” button in Settings → Help starts the TeamViewer program if it is installed on the computer; otherwise, as on macOS, it opens in the browser the TeamViewer page from which the program can be downloaded. The OptiSwift Software does not open any session by itself and sends us nothing. You start the session yourself, by giving the support person the code shown by TeamViewer, and it lasts for as long as the TeamViewer window stays open. During that time we see the computer’s screen, with everything displayed on it; we process what we see only on behalf of the Practice (§ 0.3).

2.8 · Error reports

When it encounters an error, the Software sends us a report: the installation and session identifiers, the Software version, the operating system and the version of its web component, the error’s name, message and stack trace, filtered (§ 4), the screen in the Software on which the error occurred and the last actions before it, the time and, if the person writes one, a short description. The server adds the internal identifiers of the Practice and of the signed-in person. The Software also sends a periodic heartbeat, with the installation identifier, the Software version and the operating system, to which the server adds the Practice’s internal identifier; it tells us when an installation stops reporting. Reporting can be turned off on each computer, in Settings → Help → “Error reports”, with the option “Don’t send reports from this computer”; once it is off, the Software sends neither reports nor heartbeats.

2.9 · The assistant in the Software

What the assistant’s provider receives and what we keep is described in § 8.

2.10 · What we do not do

We do not sell or rent out data.
We do not show advertisements and do not use advertising or tracking cookies.
We do not send newsletters. Apart from messages about the OptiSwift subscription sent to those who requested a trial account (§ 3.1) and notices about the Practice’s subscription, we do not send you commercial communications without your prior consent, requested separately.
We do not use your data or the data of any Practice to train or fine-tune artificial intelligence models.
We do not keep the text of the questions put to the assistant or its answers (§ 8).
We do not send invitations on behalf of the Practices taking part in the referral programme, and we do not receive the data of the people to whom they give their code (§ 2.12).

2.11 · Data we do not receive directly from you

business details, from the public taxpayer register kept by ANAF; for an authorised self-employed person (PFA), a sole enterprise or an individual practice, these are the data of an individual;
data entered by a colleague, for example the billing email address of the Practice’s accountant or the name and position of the person who activates the subscription;
the card’s brand, last four digits and expiry date, from Stripe;
error reports, generated automatically by the Software.

2.12 · The referral programme

When a Practice takes part in the OptiSwift referral programme, described in the Referral Programme Rules published at www.optiswift.ro/abonament/regulament-recomandare, or activates its subscription with a referral code, we record:

participation: the referral code assigned to the Practice, the time of assignment and the account that requested it;
proof of acceptance of the Rules, as in § 2.5: the version, the date and time, the name and email address of the person accepting, the internal identifier of their account, the IP address and the identifier of the browser or of the Software (user agent), and, for an acceptance on the Site, also those passed to us by the Site’s server;
referrals: for each activation made with a code, the code used, the CUI of the activating business, the plan and number of locations of the first subscription, the amount of the discount on the first annual payment, the status of the referral and the reason for it, the dates on which the status changed and the identifiers of the Stripe invoices from which the rewards arise;
referral credit and discounts: the free months earned, used, lapsed or cancelled and, for each discount applied to a payment, the Stripe invoice, the number of months, the value of one month and the amount of the discount.

Whoever enters a code at activation is shown the name of the referring Practice, so that they can confirm the referral. The referring Practice is not shown the names or details of the businesses it referred: it sees only how many referrals are at each status and its own free months. We do not receive the email addresses or telephone numbers of the people to whom a Practice gives its code, because the Practice passes the code on itself. A code’s page at www.optiswift.ro/r/… records nothing about who opens it.

3 · Why we process the data and on what legal basis

3.1 · Purposes and legal bases

Our clients are businesses. When an individual acts for a business — as its representative, contact person or user — we process their data in order to conclude and perform the contract with the business, on the basis of our legitimate interest in concluding and performing that contract (Article 6(1)(f) GDPR). When the client is itself an individual, for example the holder of a PFA or of an individual practice, the legal basis is the performance of the contract or the steps taken at their request before entering into it (Article 6(1)(b) GDPR). Below, “the contractual basis” means whichever of these two bases applies.

The Site and correspondence

Displaying the Site and protecting it against abuse — the hosting logs. Legal basis: our legitimate interest in making the Site available securely (Article 6(1)(f) GDPR).
Replying to messages received through the contact form or by email. Legal basis: our legitimate interest in replying to those who write to us (Article 6(1)(f) GDPR) or the contractual basis, where the message concerns a contract with us.

The trial account

Opening and running the trial account, with its emails. Legal basis: the contractual basis — steps taken at the business’s request before a possible subscription. The tick box on the trial form confirms that you are asking for the account to be opened and its emails to be sent; it is not consent within the meaning of Article 6(1)(a) GDPR.
Filling in the business’s details from the ANAF register. Legal basis: the contractual basis and our legitimate interest in not opening accounts for businesses that do not exist (Article 6(1)(f) GDPR).
Limiting abuse — one trial account per business and per email address, and no more than three sign-ups per hour from the same IP address. Legal basis: our legitimate interest in preventing fake accounts and overloading of the Service (Article 6(1)(f) GDPR).
Contacting you about an OptiSwift subscription, by telephone or email, while the trial lasts. Legal basis: our legitimate interest in offering a subscription to the business that requested the trial (Article 6(1)(f) GDPR). By email we write to you only about the OptiSwift subscription, at the address given in the trial request, in accordance with Article 12(2) of Law no. 506/2004, and every such email tells you how to object, simply and free of charge. You may object at any time (§ 3.2).

The subscription

Activating the subscription, the licence account, the account portal and providing the Service. Legal basis: the contractual basis.
Collecting subscription payments through Stripe, showing payments and the payment method, subscription notices and changing the licence account’s address. Legal basis: the contractual basis.
Proof that the contracts were concluded — which version was accepted, when, by whom, from which IP address and with which program — and keeping the accepted texts. Legal basis: our legitimate interest in being able to prove the contract and to defend ourselves in the event of a dispute (Article 6(1)(f) GDPR); for the Data Processing Agreement, also the obligation to conclude it in writing and to be able to demonstrate compliance with the GDPR (Article 6(1)(c), Article 28(9) and Article 5(2) GDPR).
Issuing fiscal invoices, submitting them through the RO e-Factura system (Romania’s national e-invoicing system) and keeping accounting records. Legal basis: legal obligation (Article 6(1)(c) GDPR), under the Fiscal Code (Article 319), Government Emergency Ordinance (OUG) no. 120/2021 and Accounting Law no. 82/1991.
Responding to a disputed payment and to suspicious payments. Legal basis: our legitimate interest in not losing a payment that is owed and in preventing fraud (Article 6(1)(f) GDPR).
The referral programme — participation, the code, referrals, granting and using discounts, and the programme’s emails. Legal basis: the contractual basis (the Referral Programme Rules).
Checking the referral programme’s conditions and preventing abuse — comparing the CUI of the referred business with our client and billing records and with the businesses in the accounts of the referring Practice and of the referred business, the caps, and review by a person of unclear cases. Legal basis: our legitimate interest in granting discounts only under the conditions of the Rules (Article 6(1)(f) GDPR).
Proof of acceptance of the Referral Programme Rules. Legal basis: our legitimate interest in being able to prove the contract and to defend ourselves in the event of a dispute (Article 6(1)(f) GDPR).

Support and running the Software

Responding to support requests and to issue reports from the Software, and remote assistance sessions. Legal basis: the contractual basis.
Error reports and heartbeats. Legal basis: our legitimate interest in keeping the Software running and fixing its errors (Article 6(1)(f) GDPR).
The text-free measurements of the assistant in the Software (§ 8.5). Legal basis: our legitimate interest in checking that the assistant works correctly and at what cost (Article 6(1)(f) GDPR).

Our legal obligations and rights

Responding to requests from authorities and courts. Legal basis: legal obligation (Article 6(1)(c) GDPR).
Establishing, exercising or defending legal claims in court. Legal basis: our legitimate interest in defending our rights (Article 6(1)(f) GDPR).
Handling requests by which you exercise your rights and keeping proof of the response. Legal basis: legal obligation (Article 6(1)(c) and Articles 12–22 GDPR).
Proof of deletion of data (the deletion register, § 6.3). Legal basis: our legitimate interest in being able to prove what we deleted, when and at whose request, and the obligation to be able to demonstrate compliance with the GDPR (Article 6(1)(f) and Article 5(2) GDPR).

We do not base any processing described in this policy on consent. As controller, we do not process special categories of data within the meaning of Article 9 GDPR. Patient data that do reach us — in an email, an issue report, a screenshot, the description of an error report or on the screen seen during a remote assistance session — are processed by us only as the Practice’s processor, under the Data Processing Agreement.

3.2 · The right to object

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, by writing to us at contact@optiswift.ro. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims (Article 21 GDPR). If you object to being contacted about a subscription, we will no longer contact you for that purpose, with no further conditions.

3.3 · If you do not provide the data

The Site can be read without giving us any data.
Without the CUI, business name, name, email address and telephone number, we cannot open the trial account.
Without the business’s details, the name and position of the person activating and the billing email address, we cannot conclude the subscription contract. The billing details are also required by law, for issuing the invoice (Article 319 of the Fiscal Code).
Without a name, an email address and a message, we cannot reply to a message sent through the contact form.

4 · Error reports: what leaves the Software

Before it is sent, the error report passes through a filter that removes: values quoted in the database’s error messages; text in quotation marks that is not a technical identifier; query strings in addresses; session and authorisation tokens and access keys; the name of the computer’s user account and the path of the home folder; email addresses, IBANs, personal numeric codes (CNP), tax codes preceded by “RO”, telephone numbers and any unbroken string of at least seven digits. The server that receives the report applies filtering rules again.

The filter does not remove:

technical identifiers (UUIDs), kept on purpose: without them we cannot link the report to the record that caused the error. Such an identifier, which may also appear in the address of the screen in the Software, says nothing about a person to anyone without access to the database;
the database error code, passed on untouched, in a separate field;
a person’s name written in free text, for example in a note or in the description added to the report. No automatic rule recognises it; the filter catches a name only when the database quotes it as a value in an error message. That is why we ask you not to write patient data in the description of a report.

We do not sell data and do not disclose them to anyone other than those listed below.

5.1 · Providers that process data for us

They work for us under contract, only on our instructions and with an obligation to keep the data confidential and secure:

Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 — hosts the Service: the database, authentication, files and server functions. This is where the data of trial requests and trial accounts, licence accounts, billing details, proof of acceptance, screenshots attached to issue reports, error reports and the Service’s technical logs are held. The data are stored in Ireland, on Amazon Web Services infrastructure in the eu-west-1 region.
Vercel Inc., United States — hosts the Site and the account portal; processes IP addresses, the technical details of requests, the CUI looked up from the trial form and the data sent through the contact form and the account portal.
Plus Five Five, Inc. (“Resend”), 2261 Market Street #5039, San Francisco, CA 94114, United States — sends the emails of the Service and of the Site: the emails of the trial account, the licence account and the subscription and, to us, messages from the contact form, issue reports from the Software, error reports and notices of new trials. The emails that the Service sends on behalf of Practices, described in the Data Processing Agreement, also go out through Resend.
Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates (Geneva), Switzerland — hosts our mailboxes, including contact@optiswift.ro, and the Proton Drive space through which we deliver to a Practice, at its request, the full export of its data, in an encrypted archive whose password Proton does not receive (Data Processing Agreement, Clause 10(d)).
OpenAI Ireland Ltd., Ireland — the language model of the assistant in the Software (§ 8).
TeamViewer Germany GmbH, Germany — the remote assistance program (§ 2.7). The places of processing are given in the list of sub-processors at www.optiswift.ro/abonament/subimputerniciti.
Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland — the language model of our development and maintenance tools, used through a commercial account (§ 10.2).
Our accountant — the chartered accountant or accounting firm that keeps the accounts of OPTISWIFT S.R.L. — and the provider of our invoicing software, for the data in invoices and payment documents.

5.2 · Payments: Stripe

Subscription payments are processed by Stripe Payments Europe, Limited (Ireland), with which we have the contract, and, for payment services, by Stripe Technology Europe, Limited (Ireland).

What we send to Stripe: the business name, billing email address, address, CUI and Trade Register number, which appear on Stripe’s documents, the VAT number of a VAT-registered business, the chosen plan, the number of locations and internal identifiers of the Practice and of the activation. For a renewal on which we use referral credit, we send a discount line on the renewal’s Stripe invoice, with the description “Commercial discount – referral programme”, the number of free months, the amount and an internal identifier of the discount; for the first payment of a referred business that chooses annual payment, a discount coupon applied to the payment page, which carries only the amount of the discount. Neither the line nor the coupon contains the name or details of the other Practice.
What the person paying sends directly to Stripe: the details of the card or of the chosen payment method, on Stripe’s pages.
Stripe’s role. Stripe processes the data as our processor when it processes the payment and manages the subscription on our behalf, and as an independent controller for fraud prevention, for its own legal obligations, including know-your-customer checks, and for Link accounts. Stripe sends payment-related emails on our behalf, such as payment receipts and notices of failed payments.
The payment methods are those shown on the Stripe page: card, Apple Pay, Google Pay, Link and Revolut Pay. A Link account is an account with Stripe. For Revolut Pay you sign in to your Revolut account, and the payment details go directly to Revolut, which processes them under its own policy; we send nothing to Revolut. Apple Pay and Google Pay work through the device’s digital wallet, under Apple’s and Google’s policies respectively.
Stripe’s privacy policy: stripe.com/privacy.

5.3 · Recipients that process the data on their own account

ANAF receives the CUI when we fill in the business’s details from the public register, and the fiscal invoices, through the RO e-Factura system, as required by law.
Public authorities and courts receive data only when the law obliges us to provide them, and only the data requested.
GitHub and Microsoft, when the Software and its updates are downloaded (§ 2.1).
Stripe, Revolut, Apple and Google, in the roles described in § 5.2.

5.4 · Transfers outside the EEA

Supabase Pte. Ltd. is established in Singapore, a country for which the European Commission has not adopted an adequacy decision. The data are stored in Ireland, but the server functions may also run outside the EEA, and Supabase and its sub-processors, including those in the United States, may access the data remotely. This processing constitutes transfers, covered by the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Modules 2 and 3), which are included in Supabase’s data processing agreement.
Vercel Inc., Plus Five Five, Inc. (Resend) and Stripe, LLC, the United States company to which Stripe transfers data, are certified under the EU–US Data Privacy Framework, recognised by Commission Implementing Decision (EU) 2023/1795. Transfers to them are based on that decision and on the standard contractual clauses, which continue to apply if the decision ceases to have effect.
OpenAI: questions sent to the assistant may be processed outside the EEA, including in the United States. OpenAI Ireland Ltd. transfers the data to OpenAI affiliates or to third parties outside the EEA on the basis of the standard contractual clauses or an adequacy decision, under its data processing agreement (§ 8.2).
Proton AG is in Switzerland, a country for which the European Commission has found an adequate level of protection (Decision 2000/518/EC).
TeamViewer: the safeguards for each transfer are given in the list of sub-processors.
Anthropic: the data may be processed outside the EEA, including in the United States, on the basis of the standard contractual clauses incorporated in Anthropic’s data processing agreement.

You can obtain a copy of the applicable safeguards by writing to us at contact@optiswift.ro. The providers publish their own data processing agreements: Supabase, Vercel, Resend, Proton, Stripe, OpenAI.

6 · How long we keep the data

We keep data only for as long as they are needed for the purpose for which we hold them. When the periods below expire, the data are deleted or anonymised. We keep them longer only if the law obliges us to or if we need them to establish, exercise or defend legal claims in court, for as long as the proceedings last.

6.1 · The Site, the Service and correspondence

Operational logs of the Site and of the account portal: 1 day, as long as Vercel keeps them on the hosting plan we use (Vercel Pro); we do not copy them anywhere else.
Technical logs of the Service, kept by the Supabase platform, including those of sign-ins: 7 days, as long as Supabase keeps them on the plan we use (Supabase Pro).
The log of authentication events kept in the Service’s database (IP address, account, time and type of event): 7 days.
Data of an open session (IP address and client identifier): until the session is closed, but no longer than 90 days after it was last used.
Email delivery records at Resend: the retention period set by Resend for our account; we do not extend it.
Correspondence with people who do not become clients, including messages from the contact form: 12 months from the last message.
Correspondence with client Practices: 3 years from the last message in the conversation, the general limitation period under Article 2517 of the Civil Code.
Patient data received by email: until the request is resolved.
Requests by which you exercise your rights, and our responses: 3 years from the resolution of the request, the general limitation period under Article 2517 of the Civil Code.

6.2 · The trial

An unfinished trial request — for example, one whose confirmation link expired unused after 48 hours — is closed, and 30 days after closure it is deleted in full.
A finished trial request — the account was opened, or the address was confirmed without a password being chosen: the name, email address, telephone number, town and IP address hash are deleted 90 days after the request was last changed, and, for an opened account, 90 days after it was opened.
What remains after the data of a request for which an account was created are deleted: the CUI, the business name, the county, whether the business was found in the ANAF register and the email address hash. We keep them for as long as we offer trial accounts, for the rule “one trial account per business and per email address”. After the trial account is deleted, its entry in the deletion register (§ 6.3) also remains.
The trial account: lasts 7 days. When it expires, the Software no longer opens the demo practice; sign-in remains possible until the account is deleted, so that you can activate the subscription. 3 days after expiry the account is deactivated, and 10 days after expiry its data are deleted, including files and sign-in details (the email address and the password hash).
The trial account of a business that has activated the subscription: the trial account’s email address and password become the sign-in details of the Practice’s licence account. The demo data are not transferred to the Practice’s account and are deleted within 10 days of activation at most.
The internal notice of a new trial (§ 2.3): deleted from our mailbox within 90 days of receipt at most.

6.3 · Client Practices

The licence account, billing details, subscription, copies of Stripe payment documents and the payment method in brief: for the duration of the subscription and for 30 days after it ends, while the Practice can export its data; they are then deleted together with the Practice’s data, within 30 days at most.
Changes to the licence account’s email address: deleted automatically 30 days after the change was applied, cancelled or expired.
Codes for continuing a payment in the browser and other short-lived technical payment data: deleted automatically within two days of their expiry at most.
An unfinished activation: closed automatically if it has not been used for 90 days. Once it has closed without payment, but no earlier than 90 days after it began, the business name, Trade Register number, address, town, county, postcode, location name, the name and position of the person who activated and the billing email address are deleted or replaced with the word “redacted”, and the name, position, email address, IP address and browser identifier of the person who accepted are deleted from the proof of acceptance. What remains is the CUI, the VAT status, the plan, the number of locations, the Stripe payment identifiers and, from the proof of acceptance, the version of the documents, their hash and the time of acceptance; these are deleted 3 years after the activation began.
A paid activation and proof of acceptance of the contracts: for the duration of the contract and 3 years after it ends, the general limitation period under Article 2517 of the Civil Code. The identifying details of the person who activated and accepted — name, position, email address, IP address and browser identifier — are then deleted, while the version of the documents, their hash and the time of acceptance remain, without personal data. The published texts of the documents contain no personal data and are kept.
The billing details at the time of each payment, and fiscal invoices: 5 years, counted from 1 July of the year following the end of the financial year in which they were drawn up (Article 25 of Accounting Law no. 82/1991); they are then deleted.
Records of the referral programme (codes, referrals, referral credit and discounts) and proof of acceptance of the Rules: for the duration of participation and 3 years after the Practice’s last reward or discount, the general limitation period under Article 2517 of the Civil Code; they are not deleted together with the Practice’s data when the subscription ends. Discounts shown on a fiscal invoice and the records of fully discounted renewals, which prove the discount, are kept like accounting documents, as in the point above. The identifying details of the person who accepted the Rules are then deleted; the CUI of the referred business and the time of the referral remain for as long as the programme runs, for the rule that a business can be referred only once.
Data kept by Stripe are retained under Stripe’s policy and legal obligations.
The deletion register. After the data of a Practice or of a trial account are deleted, we keep an entry with the account name, the number of records deleted from each table and the list of files deleted, as proof of deletion; the accounts’ email addresses are removed from it when the accounts are deleted. The entry has no deletion date, because we may be asked for proof of deletion at any time; we remove the name from it at the request of the Practice or of the data subject. We keep the written request to terminate the contract, with its author, and the deletion certificate for 3 years from the issue of the certificate.

6.4 · Support and running the Software

Issue reports from the Software: the text received by email, 12 months from sending; screenshots, until the Practice’s data are deleted when the contract ends (Data Processing Agreement, Clause 10(d)). If the subscription ends sooner, the text is also deleted together with the Practice’s data.
Remote assistance sessions: we do not record them; the technical data of the connection (the computers’ TeamViewer IDs, IP addresses, and the date, time and duration of the session) are kept by TeamViewer, under its data processing agreement.
Error reports: 90 days from receipt; the description written by the person reporting is deleted after 30 days. Heartbeats and alerts built from reports are kept for 180 days. After a Practice’s data are deleted, the remaining reports are no longer linked to it. Copies received by email are deleted from our mailbox within 90 days at most.
The assistant: the text of questions and answers is not kept by us. The text-free measurements (§ 8.5) are kept for the duration of the subscription and deleted together with the Practice’s data. OpenAI’s abuse-monitoring logs are kept for 30 days at most (§ 8.4).

6.5 · Backups

The Service’s database is backed up daily, and the backups are kept for 7 days (§ 10.3). Information deleted from the database may still exist, for up to 7 days, in such a backup, which is used only to restore the Service.

7 · Your rights

7.1 · What rights you have

Under the conditions of Articles 15–21 GDPR, you have the right:

of access: to find out whether we process data about you and to receive a copy of them, together with the information in this policy;
to rectification: to have us correct inaccurate data and complete incomplete data;
to erasure: to have us delete the data, for example when they are no longer needed for their purpose or when you object to the processing and we have no overriding legitimate grounds;
to restriction of processing: to have us keep the data without using them, for example while we check their accuracy or your objection;
to data portability: to receive, in a structured, commonly used and machine-readable format, the data you have provided to us and that we process by automated means on the basis of a contract with you, and to ask for them to be transmitted directly to another controller, where technically feasible;
to object: to object to processing based on our legitimate interest (§ 3.2).

We do not base any processing in this policy on consent. If we ever ask for your consent, you will be able to withdraw it at any time, without the withdrawal affecting the processing carried out before then.

7.2 · How to exercise your rights

Write to us at contact@optiswift.ro or by post to the registered office (§ 1). If the request does not show that it comes from the data subject, we may ask you for confirmation, for example a reply from the email address we have on record. We respond free of charge, within one month of receiving the request at most. For complex or numerous requests, this period may be extended by up to two further months; in that case we will tell you within the first month and explain why. We may refuse a request that is manifestly unfounded or excessive, or charge a reasonable fee, in accordance with Article 12 GDPR.

7.3 · Data we cannot delete immediately

We keep some data even if you ask for them to be deleted: invoices and accounting documents, for as long as the law requires, and proof that the contracts were concluded, for the period in § 6.3, for the establishment, exercise or defence of legal claims (Article 17(3)(b) and (e) GDPR). Until the period expires, we use them only for these purposes.

7.4 · Complaints to the supervisory authority and the courts

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania’s data protection authority, B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, postcode 010336, București; telephone +40 31 805 9211; email anspdcp@dataprotection.ro; www.dataprotection.ro. You may also bring proceedings before a court.

7.5 · Automated decisions

We do not build profiles. The Service’s automated rules apply the terms of the trial account and of the subscription without evaluating personal aspects: the limit of three sign-ups per hour from the same IP address, the rule of one trial account per business and per email address, the expiry of the trial and the consequences of a missed payment set out in the subscription terms. The rules of the referral programme are also applied automatically: the conditions in the Rules, the caps, when rewards are granted, and the lapse and cancellation of credit. Unclear cases — a CUI that cannot be verified, our own CUI or a large number of referrals by the same Practice in a year — are not decided automatically: a person checks them before rewards are granted. If, for a client who is an individual, applying such a rule is a decision based solely on automated processing, it is necessary for the performance of the contract (Article 22(2)(a) GDPR), and you have the right to obtain human intervention, to express your point of view and to contest the decision, by writing to us at contact@optiswift.ro.

7.6 · If you are a patient

For the data in your patient record, please contact the Practice (§ 0.3).

8 · The assistant in the Software: where the words typed into the box go

Next to the assistant box, the Software asks you not to write data about patients and tells you that the question is sent to an external artificial intelligence provider and is processed outside the European Union. This section explains who that provider is, what it receives and what it does with what it receives.

8.1 · What the assistant is and how to turn it off

The assistant answers questions about using the Software, based on the Software’s manual. It is an artificial intelligence system: its answers are generated automatically, may be wrong and are not medical, legal or tax advice. It has no access to the Practice’s database.

The assistant is on by default for every Practice with a subscription. The Practice’s administrator can turn it off for the whole Practice in Settings → Help (“Assistant on for the whole practice”); while it is off, no question leaves the Software. We also have a switch for all Practices, which we use in the event of an incident. The assistant does not work in trial accounts.

We process the text of the questions on behalf of the Practice, under the Data Processing Agreement. We describe it here so that anyone who types in the box knows where it goes.

8.2 · The provider and the place of processing

The assistant’s language model is provided by OpenAI. The company with which we have the contract is OpenAI Ireland Ltd., in Ireland. The question is sent to OpenAI’s “Responses” application programming interface, at the global address api.openai.com, not at the European address eu.api.openai.com. On the global address, OpenAI does not guarantee a processing region, so the question may be processed outside the EEA, including in the United States.

The processing is governed by OpenAI’s data processing agreement, which forms part of our services agreement with OpenAI. Transfers outside the EEA, to OpenAI affiliates or to third parties, are made on the basis of the European Commission’s standard contractual clauses or an adequacy decision. When the contract ends, OpenAI returns or deletes the data on our instructions, except for data that the law requires it to keep. If we move to the European address, this policy will receive a new version.

8.3 · What OpenAI receives

Text only:

the assistant’s instruction, the same for all Practices: its rules and the manual’s table of contents;
the text of a few articles from the manual, chosen by the server according to the question or, at a second step, requested by the model from the manual’s table of contents;
the title of the manual article that corresponds to the open screen, not the screen’s address;
the question as written, after the filter below;
at most three earlier questions from the same conversation — the questions, not the answers.

A greeting or a thank-you, written on its own, receives a reply written by the Software and is not sent to OpenAI, either then or together with later questions.

OpenAI receives nothing from the Practice’s database. The assistant has no tool with which to search the database, reads no table and does not have the Service’s service key: the model cannot read the database, search it or act on it, and nothing the server sends it comes from the database. The request carries no identifier of the Practice or of the person asking.

Before sending, the Software removes from the question personal numeric codes (CNP), IBANs, email addresses, telephone numbers, tax codes preceded by “RO” and access credentials, and the server refuses a question that still contains them. The filter cannot recognise a name: if you write a patient’s name, the name is sent. Do not write patient data in the assistant box.

8.4 · What OpenAI does with what it receives

Model training. OpenAI does not use content received through the application programming interface to develop or improve its services and models unless the customer expressly agrees to this. We have not agreed to it, and we have undertaken, in the Data Processing Agreement, not to agree to it.
Abuse-monitoring logs. OpenAI keeps them for all use of the interface, and they include the content sent; it keeps them for 30 days at most, unless the law requires longer retention. We have not requested from OpenAI the “Zero Data Retention” or “Modified Abuse Monitoring” arrangements, under which content is excluded from these logs and which are granted only with OpenAI’s prior approval.
Retention of the response. Every request carries the setting store: false, so OpenAI does not keep the generated response. The request does not refer to a previously stored conversation or response. The setting does not affect the abuse-monitoring logs.
Prompt caching. OpenAI temporarily keeps not the text as such, but intermediate computation states derived from the content of the request, which may include the question, so that it can respond faster to a request that begins in the same way. They serve only our organisation’s requests to OpenAI and are kept for at least 30 minutes from their last use; OpenAI does not publish a maximum duration, but states that it does not keep them indefinitely. We do not ask for longer retention than the default.

Sources: OpenAI services agreement · OpenAI data processing agreement · Data sent through the API · Prompt caching.

8.5 · What we keep

We do not keep the text of the questions or the answers. For each question we record, per Practice, only text-free measurements: the outcome (for example, answer given, off-topic question, daily limit reached), how many manual articles were found and how relevant they were, how many were cited, the number of text units (tokens) processed and the response time. We also keep each Practice’s number of questions per day, for the daily limit. We use them to check that the assistant works correctly and at what cost.

9 · Data protection officer

We have not appointed a data protection officer. Under Article 37(1)(c) GDPR, an appointment is mandatory where the core activities of the controller or processor consist of processing on a large scale of special categories of data, such as health data. We process health data only on behalf of Practices (§ 0.3). We have assessed in writing the scale of this processing — the number of Practices and patients, the volume and nature of the data, the duration and the geographical extent — and concluded that, at the date of this version, it is not large-scale processing. We review this conclusion at least once every six months and whenever the number of Practices or of patients whose data we host increases significantly. If we appoint a data protection officer, we will publish their contact details in this policy and notify them to the National Supervisory Authority for Personal Data Processing.

For any question about personal data, you can write to us at contact@optiswift.ro.

10 · Security

10.1 · The main measures

Each Practice’s data are separated by row-level security: a session authenticated for one Practice cannot read another’s data. Our billing data and the proof of acceptance cannot be read directly from the database by a Practice’s session; the Practice sees only the data of its own subscription, through the subscription screens and through its own audit log.
Access to each category of data in the Software depends on named permissions granted to each person.
Signing in to the Software takes two steps, first with the Practice’s licence account and then as the individual person, and the Software locks after a period of inactivity set by the Practice. The Software and the Site require passwords of at least 10 characters; passwords are kept only as hashes.
The Software and the Site communicate with the Service only over encrypted connections (TLS), and the data are also encrypted at rest (AES-256), according to Supabase’s public statement. The Software’s main window can communicate only with the Service; payment pages open in a separate window with no access to the Software’s data.
Files — clinical images, documents, photographs, the e-Factura archive and screenshots attached to issue reports — are kept in private stores, separated by Practice.
Changes to data, exports and printouts are recorded in the audit log, with their author and time.
Error reports are filtered before they are sent (§ 4).
The measures applied to the data we process for Practices are described in detail in Annex III to the Data Processing Agreement.

10.2 · Our access to Practices’ data

Only people authorised by us, who are bound by confidentiality, have access to the Service’s systems, and only to the extent they need it for maintenance, support or resolving an incident.
We see the screen of a Practice’s computer only in a remote assistance session started by the Practice and in the screenshots that the Practice’s staff attach to an issue report (§ 2.7).
Our AI-assisted development and maintenance tools receive data only through a commercial account with Anthropic (§ 5.1), never through a consumer or personal account, only in sessions led by an authorised person and, for Practices’ data, only under the conditions set out in § 11.1 of the Data Processing Agreement; wherever possible, queries return only counts and technical identifiers.

10.3 · Backups

The Service’s database is backed up daily by Supabase, and the backups are kept for 7 days. We do not have point-in-time recovery. A restore returns the whole database, for all Practices at once, to its state in the last daily backup, so up to 24 hours of work can be lost. Uploaded files — clinical images, documents, patient photographs, the e-Factura archive and screenshots attached to issue reports — are not included in these backups: a database backup contains only the record of the files, not the files themselves, so a lost or deleted file cannot be recovered from it.

10.4 · What does not exist

We also state which measures we do not have, so that you can take them into account:

there is no log of reads: the audit log records changes, exports and printouts, not mere viewing of data;
there is no point-in-time recovery (§ 10.3);
accounts in the Software have no second authentication factor, such as a code sent to a phone;
we hold no security certification and have not been independently audited; the certifications declared by the hosting platform are its own, not ours.

10.5 · Personal data breaches

If a security breach affects data for which we are the controller and poses a risk to individuals, we notify the National Supervisory Authority for Personal Data Processing without undue delay and, where feasible, within 72 hours of becoming aware of it; if the risk is high, we also inform you directly (Articles 33 and 34 GDPR). For data we process on behalf of Practices, we notify the Practice, under the terms of the Data Processing Agreement.

11 · Changes and versions

Each version of the policy has an identifier and a date, in its heading. The version in force is published at www.optiswift.ro/confidentialitate.
We keep the full text of every version and send it to anyone who asks for it.
We publish a substantive change here before it applies and announce it to client Practices by email, at the licence account’s address.
This policy is information, not a contractual clause, and we do not ask for your consent to it. When the subscription is activated, the Software and the Site record the version of the policy that the person activating has read.

12 · Version history

PRIV-1.2 · 6 October 2026 — the first version published by OPTISWIFT S.R.L.
PRIV-1.3 · 9 October 2026 — turning off error reports in the Software; Anthropic, for AI-assisted development and maintenance tools; TeamViewer’s name; the maximum duration of an unused session; Proton Drive, for delivering the full export; cookies and tab storage in the account portal.
PRIV-1.4 · 11 October 2026 — the referral programme (§ 0.2, § 0.3, § 2.10, § 2.12, § 3.1, § 5.2, § 6.3, § 7.5).